none
Hyper-V VM failed to start - General access denied errror

    Question

  • HI,

     

    When i'm trying start my newly created virtual machine  I've got error:

     

    VMMS Account does not have sufficient privilege to open attachment ".....\SRVVirt.vhd"

     

    I am logged in as administrator, Services ara running with following accounts :

     

    Hyper-V Image Management Service - Network Service

    Hyper-V Networking Management Service - Local System

    Hyper-V Virtual machine managemet - Local System

     

    Operating system is clear installation of Windows Server Standard 2008 RTM with Hyper-V

     

    Installed roles :

     

    Application server

    File Services

    Hyper-V

    Web Server

     

    any suggestions on how to overcome this issue and get the hypervisor running would be greatly appreciated.

    thanks.

     

    Radek

     

    .

    Monday, March 31, 2008 11:02 AM

Answers

  • Hi,

    I had the same problem.

    My solution was: I gave the *.vhd file the permission 'full' for the group 'Users'

     

    Greetings from Germany

    Michael

    Thursday, May 15, 2008 5:34 AM
  •  

    It turns out that There are 3 Hyper-V services.  2 of them are Logon as System, and one as Network Service.  When looking at the vhd, the System has full control, but Network Service doesn't.

     

    After adding Network Service -> Full Control, the VM Starts.  Maybe this is more secure than All Users -> Full Control?  I don't know.

     

    -Michael Quinn

    Saturday, May 17, 2008 6:00 PM

All replies

  • 2 thoughts: Check the permissions directly on the file mentioned and temporarily disable UAC to see if that helps anything.  You could also scrap the existing VM and try another new one.

     

    Monday, March 31, 2008 6:29 PM
  • Where is the virtual hard disk stored?  If you remove the virtual hard disk - does the VM start correctly?

     

    Cheers,

    Ben

    Monday, March 31, 2008 6:35 PM
  • Thanks for your reply,

     

    Permissions on the *.vhd file :

    SYSTEM -  Full control

    BATCH  -  Modify, Read & Execute, Read, Write

    Adiminstrators - Full Control

    INTERACTIVE - Modify, Read & Execute, Read, Write

    SERVICE - Full control

    51853824-58D4-4E9B-AAA5-F11C1010553B (?????) - Full control

     

    UAC if turned off. Result is everytime .

     

    "IDE/ATAPI - Failed to attach to location 0/0 of IDE Controller."

     

    Radek

     

     

    Tuesday, April 01, 2008 6:19 AM
  • Currently the virtual hard disc image is stored under "C:\Users\Public\Documents\Microsoft Hyper-V\Virtual Hard Disks\", but I have tryied other locations without success.

     

    When I remove the virtual hard disk , VM does not start . The error is :

     

    IDE/ATAPI : Failed to attach '' to location 1/0 of IDE Controller.

     

     

    Radek

    Tuesday, April 01, 2008 6:25 AM
  • Hi Ben,

     

    this is the supplement to my previous post. When I remove all devices from both IDE controllers, VM starts successfully . Possibly there is a problem with SPN's. Host machine has following SPN¨s registered.

     

            Microsoft Virtual Console Service/srvsql.hk.ssw.cz
            Microsoft Virtual Console Service/SRVSQL
            TERMSRV/SRVSQL
            TERMSRV/srvsql.hk.ssw.cz
            HOST/SRVSQL
            HOST/srvsql.hk.ssw.cz

     

    Is it enough ?

     

    Radek

    Tuesday, April 01, 2008 12:31 PM
  • Have you installed the RC release of Hyper-V?  If no - can you try it out?

     

    Cheers,

    Ben

    Thursday, April 03, 2008 6:12 PM
  • Just had the exect same problem on my server - I'm using the RC....any luck with solving this?

     

    Saturday, April 05, 2008 8:25 AM
  • Hi,

     

    currently I am using RC0 of HYper-V, but the same error occured in Beta. Windows Server is RTM Version.

     

    It is strange that the same error occurs even in case when I remove all *.vhd disks from virtual machine .

     

    For example when I  attach only one physical CD Drive to VM, the error stays the same.

     

    It seems  the problem is in Virtual IDE/ATAPI Controller, not in *.vhd file.

     

    Regards,

     

    Radek

     

     

    Sunday, April 06, 2008 2:32 PM
  • What is the exact error message that you see when no .VHDs are attachedd?

     

    Cheers,

    Ben

    Monday, April 07, 2008 5:47 PM
  • Hi Ben,

     

    summary of situation is mentioned below :

     

    1) IDE Configuration = IDE Controller 0 = NOTHING, IDE Controller 1 =NOTHING

    VM Starts succesfully

     

    2) IDE Configuration = IDE Controller 0/1 - *.VHD file, IDE Controller 1/0 - Physical DVD Drive
     

    Log Name:      Microsoft-Windows-Hyper-V-Worker-Admin
    Source:        Microsoft-Windows-Hyper-V-Worker
    Date:          4/10/2008 9:51:14 AM
    Event ID:      12290
    Task Category: None
    Level:         Error
    Keywords:     
    User:          NETWORK SERVICE
    Computer:      srvsql.hk.ssw.cz
    Description:
    'RKVIRT001': VMMS Account does not have sufficient privilege to open attachment 'C:\Users\Public\Documents\Microsoft Hyper-V\Virtual Hard Disks\RKVIRT001.vhd'. Error: 'General access denied error' (0x80070005). (VMID B83D9802-3C36-41E3-A12F-ABFB8A325EB3)

     

    3) IDE Configuration = IDE Controller 0 = Physical DVD , IDE Controller 1 = NONE

    Log Name:      Microsoft-Windows-Hyper-V-Worker-Admin
    Source:        Microsoft-Windows-Hyper-V-Worker
    Date:          4/10/2008 10:00:51 AM
    Event ID:      12220
    Task Category: None
    Level:         Error
    Keywords:     
    User:          NETWORK SERVICE
    Computer:      srvsql.hk.ssw.cz
    Description:
    'RKVIRT001' IDE/ATAPI: Failed to attach 'G:' to location  0/0 of IDE Controller. Error: 'General access denied error' (0x80070005). (VMID B83D9802-3C36-41E3-A12F-ABFB8A325EB3)

     

     

    Regards,

     

    Radek

    Thursday, April 10, 2008 8:43 AM
  • Hi,

    I was wondering whether there was any resolution to this problem?  I have exactly the same issue.  It's also worth noting that I have exchange server 2007 installed on this box, so I'm wondering after reading some of the posts whether this might be having an impact?

     

    Thanks,

    Rob.

    Sunday, May 04, 2008 11:32 PM
  • There could be several things at work here - in fact, I had this problem and finally got it working, but I did so many things, I honestly cant' remember what the exact fix was!

     

    Try reading John Howard's Technet Blog about Hyper-V

     

    http://blogs.technet.com/jhoward/ - parts 1-3

     

    This may or may not be it but I printed it out and put it in my 2008 folder for reference - good luck!

     

     

     

     

    Thursday, May 08, 2008 10:30 PM
  • Hi,

    I had the same problem.

    My solution was: I gave the *.vhd file the permission 'full' for the group 'Users'

     

    Greetings from Germany

    Michael

    Thursday, May 15, 2008 5:34 AM
  •  

    It turns out that There are 3 Hyper-V services.  2 of them are Logon as System, and one as Network Service.  When looking at the vhd, the System has full control, but Network Service doesn't.

     

    After adding Network Service -> Full Control, the VM Starts.  Maybe this is more secure than All Users -> Full Control?  I don't know.

     

    -Michael Quinn

    Saturday, May 17, 2008 6:00 PM
  • there is no need to give Full control to the network service. "Write" and "execute" is enough!!!
    Thursday, June 12, 2008 10:42 AM
  • My Hyper-V was working properly until I reboot the computer and then I'm getting the same error message as posted (event ID 12290 and 12220). 

    I tried all suggested solution mention above, even give full access to everyone for the .vhd file, but it failed to start.
     
    Any more suggestion?

    Monday, July 28, 2008 3:51 PM
  • I have the same problem.  Hyper-V was working properly until the computer was rebooted and now I get 12290 and 12220 errors.  I have deleted all of the virtual machines, uninstalled and then reinstalled Hyper-V, checked all of the permissions listed in this thread and the only time VM's start is when there isn't a virtual IDE device specified in the configuration - either DVD or hard disk.

    Any other suggestions?
    Saturday, November 15, 2008 4:51 AM
  • If you have an Intel motherboard with Intel's management software installed try adding the 'network service' account to the administrators group.  I had this issue with the S5000VSA.  Intel has an error in their driver code that requires the network services account to be elevated to administrative privileges.  I do not believe they have fixed this error.  Uninstalling the package will not fix this issue.
    Wednesday, December 03, 2008 3:05 PM
  • Hi,

    Intel released a fix for this issue in mid nov. 2008.

    Check http://www.aperture.ro/index.php/2009/01/intel-releases-patch-for-ipmi-driver-causing-conflicts-in-microsoft-hyper-v/ for details.

    Cheers,
    Z
    • Proposed as answer by chanchan Saturday, August 29, 2009 10:01 AM
    Monday, January 19, 2009 7:37 PM
  • Hi Z,


    <QUOTE>

    Hi,

    Intel released a fix for this issue in mid nov. 2008.

    Check http://www.aperture.ro/index.php/2009/01/intel-releases-patch-for-ipmi-driver-causing-conflicts-in-microsoft-hyper-v/ for details.

    Cheers,
    Z

    </QUOTE>


    Thanks for the post and blog post. This is the solution for me.

    Applied the patch, rebooted the server and problem is gone. Time wasted: like 2 hours :)

    Details:

    Setup the 2k8x64 with Hyper-V, installed Intel Management Agent 3.0 and reboot. Tried to configure pass-through disk access for Storage Server 2003 in Hyper-V for testing (which is not related to the problem), experienced the problem.

    All other VM (even without pass-through disk access) also failed to start.

    Also the IPMI driver caused the hardware management device to lose track of the memory thermal margin, which caused the system fan to go into critical level (from 2000 rpm to 1000 rpm) and had to uninstall the agent before it back up again.

    Tuesday, January 27, 2009 12:39 PM
  • I just ran into this after running a year's worth of windows updates. What finally worked was to simply change the Hardware configuration Channel to Primary Channel (1) AND THEN Change it back to Primary Channel (0) (in use).
    • Proposed as answer by Darius Lovitt Wednesday, March 02, 2011 7:32 PM
    Monday, May 24, 2010 5:47 PM
  • I started getting this issue after installing the IBM Director 6.2 agent along with their IPMI driver. 

    • Uninstalling the software/driver didn't help.
    • Granting full permission to "Network Service", "Everyone" & his dog, to the VHD files didn't help.
    • The only thing that worked was adding the "Network Service" account to the local "Administrators" group.

    The VMs could then start. I didn't even need to reboot the server. 

    I would have never guessed that it was an IBM problem. I presume they didn't learn from Intel's mistakes :(

    Thanks for all you guys' help tracking it down :)

    • Proposed as answer by GertjanVH Friday, January 21, 2011 9:10 PM
    Thursday, July 22, 2010 1:14 PM
  • What worked for me was:

    1. Shutdown the VM
    2. Detach the VHD file, apply changes
    3. Reattach the VHD file, apply changes

    This replaced the correct GUID for the VM.

    Thanks

    • Proposed as answer by zalex Wednesday, September 08, 2010 7:23 PM
    Thursday, July 22, 2010 7:19 PM
  • This was the solution for me. The issue was that I had been developing a procedure with a "master image" VHD. When I had worked out the procedure I deleted the VHD I had been testing and re-copied the master back to that location. I haven't done any further investigation but I suppose there is additional information applied to the VHD when it's used for a Hyper-V VM. When I simply copied the master to the location I had for the VHD, Hyper-V and the VM didn't recognize it. I removed the VHD and reconnected it and all was well.
    Tuesday, September 28, 2010 3:07 PM
  • Guess that should be the permission issue it should be? Please verify that.

    When you copy the file please make sure the "vm account" granted to the original file is also granted to the new file (however I cant find a way to do it because the "vm account" cannot be found (thus added) in the permission dialogue).

    Removing and reconnecting the vhd essentially allows the VM manager to grant the vm account to the vhd file.

    Tuesday, September 28, 2010 9:04 PM
  • No, I don't believe it's a permission issue. Nothing was done to the file to permit the VM any other acces at the file level. Remember, mine was an experimental process where I was not using snapshots. Instead, I deleted the working copy of the VHD and copied the original back in its place. The procedure I followed was:

    1. Experiment with VM based on copy of master image.
    2. Shut down VM.
    3. Delete experimental VHD.
    4. Copy master VHD and rename to match experimental VHD.
    5. Attempt to boot VM and discover the error above.
    6. Shut down VM.
    7. Detach the VHD from the VM using the "Remove" button.
    8. Reattach the VHD.
    9. Boot machine normally.

    At no time did I manipulate the permissions or security properties of the VHD. That must mean that Hyper-V has some additional understanding concerning the VHD (at least the one from which the OS boots for the VM) and detects this as an error condition. What it understands could be as simple as the size of the file from its last known condition or it could be some form of serialization. I don't know. But, I do know that in my scenario John's suggestion was the key to my resolution.

    • Proposed as answer by totoshka1985 Monday, November 12, 2012 7:17 AM
    Friday, October 01, 2010 3:05 PM
  • I nearly pulled out my hair today when I tried creating a new VM and got these errors. My old VM's kept running, removing old ones also worked fine, but creating new VM's was not possible. It just kept giving access denied. Even after setting all settings manually (which caused the VM to appear in the Hyper-V manager) did not allow me to run that VM. Exporting and reimporting also did not help. I tried all sorts of things, even setting the folder open for everyone, uninstall anti-virus and firewall, removing diagnostic tools like HWmonitor but nothing helped. Even went in the BIOS to see if anything strange happened.

    Since the server is also running some "semi-production" VM's I was a bit afraid to take any more action. Adding the Network service to the administrators account did the trick.

    I know the posting is old, but you really saved my day! So if anybody else is getting these kind of errors (if you google the message this thread is showing op on top), try adding the network account to the admin group.

    Friday, January 21, 2011 9:17 PM
  • Hi Michael

    This worked for me too. I had to remove a VHD file off my Hyper-V server and when I copied it back to use it again it wouldn't start. I tried your suggestion of giving the "USER" group Full Control to the VHD file and when I did the Virtual Server responded to the request to start the server.

    This was a great help. Hope it helps some others.

    Thanks

     

    Coles

    Thursday, March 03, 2011 11:18 PM
  • ease fix, in the vm's settings remove the adatper that connects to the vhd then create a new one and select the *.vhd in question
    Saturday, March 05, 2011 12:09 AM
  • This solved my problem.  Adding "NETWORK SERVICE" is much better choice than "ALL USERS".  Thanks.
    Friday, April 15, 2011 8:10 PM
  • Hi,

    i think there is a better way  by using icacls and the VMSID:

    "NT VIRTUAL MACHINE\B36EB856-5F2C-8E9A-C364-6841FDEHF7HD"

    you can set it just like that:
    icacls "H:\Virtual Machines\B36EB856-5F2C-8E9A-C364-6841FDEHF7HD.xml" /grant "NT VIRTUAL MACHINE\B36EB856-5F2C-8E9A-C364-6841FDEHF7HD":(F) /L

    or respectively to the folder containing the VMs


    edit: btw there is still no posibility to edit in GUI on WIN2008R2
    Wednesday, July 06, 2011 7:42 AM
  • In my case the 3 Hyper-V services are running logged on as Local System.

    I added the group 'Authenticated Users' with full control to the VHD file to solve the problem.

    Saturday, August 27, 2011 7:12 AM
  • Here is the Microsoft KB about the problem:

    http://support.microsoft.com/kb/2249906

    / Martin

    Thursday, September 22, 2011 7:34 AM
  • Give  modify permission to 'all users' to the .vhd file, it works
    Monday, April 02, 2012 7:19 AM